#!/usr/bin/perl use warnings; use strict; use Data::Dumper; my %messages; while (my $line = ) { if ($line =~ /relay=127\.0\.0\.1/) { my ($id, $to, $status) = (split /\s+/, $line, 10)[5,6,9]; chop($id); $to =~ s/to=<(.*?)>,/$1/; push @{$messages{$id}{to}}, $to; } } print Dumper(\%messages) and exit; __DATA__ Nov 16 10:28:51 smtp3 postfix/smtpd[17709]: connect from mailserver.ourdomain.gov.au[168.x.x.x] Nov 16 10:28:51 smtp3 postfix/smtpd[17709]: 66AE820809D: client=mailserver.ourdomain.gov.au[[168.x.x.x] Nov 16 10:28:51 smtp3 postfix/cleanup[19600]: 66AE820809D: message-id=<56FE9AD99802CE47AF144E03064331D501F42840@mailserver.gov.au> Nov 16 10:28:51 smtp3 postfix/qmgr[9315]: 66AE820809D: from=, size=11466, nrcpt=2 (queue active) Nov 16 10:28:51 smtp3 postfix/smtpd[19599]: connect from localhost.localdomain[127.0.0.1] Nov 16 10:28:51 smtp3 postfix/smtpd[17709]: disconnect from mailserver.ourdomain.gov.au[168.132.65.6] Nov 16 10:28:51 smtp3 postfix/smtpd[19599]: 883822080A4: client=localhost.localdomain[127.0.0.1] Nov 16 10:28:51 smtp3 postfix/cleanup[19594]: 883822080A4: message-id=<56FE9AD99802CE47AF144E03064331D501F42840@mailserver.ourdomain.gov.au> Nov 16 10:28:51 smtp3 postfix/qmgr[9315]: 883822080A4: from=, size=11644, nrcpt=2 (queue active) Nov 16 10:28:51 smtp3 postfix/smtp[18745]: 66AE820809D: to=, relay=127.0.0.1[127.0.0.1], delay=0, status=sent (250 Ok: queued as 883822080A4) Nov 16 10:28:51 smtp3 postfix/smtp[18745]: 66AE820809D: to=, relay=127.0.0.1[127.0.0.1], delay=0, status=sent (250 Ok: queued as 883822080A4) Nov 16 10:28:51 smtp3 postfix/smtpd[19599]: disconnect from localhost.localdomain[127.0.0.1] Nov 16 10:28:51 smtp3 postfix/qmgr[9315]: 66AE820809D: removed Nov 16 10:28:52 smtp3 postfix/smtp[19429]: 883822080A4: to=, relay=mailhost.theirdomain.com.au[203.x.x.x], delay=1, status=sent (250 Message queued) Nov 16 10:28:52 smtp3 postfix/smtp[19429]: 883822080A4: to=, relay=mailhost.theirdomain.com.au[203.x.x.x], delay=1, status=sent (250 Message queued) Nov 16 10:28:52 smtp3 postfix/qmgr[9315]: 883822080A4: removed